Union County, Ohio, Confirms Data Breach Affecting 45,587 Individuals in May Ransomware Attack Officials in Ohio’s Union County have disclosed that a May ransomware attack compromised sensitive data belonging to 45,587 individuals, including residents and county employees. The breach, which remains unclaimed by any known threat group, exposed a wide range of personal information, such as Social Security numbers, financial account details, driver’s license numbers, medical records, fingerprint data, and passport numbers. The county notified affected individuals via breach notification letters. The incident is part of a broader surge in cyberattacks targeting state and local governments this year. In June, the town of Waxhaw, North Carolina, confirmed a ransomware attack by the Qilin gang, which resulted in the theft of over 600 GB of data. Other recent victims include Lorain County, Ohio, and the Maryland state government, highlighting persistent vulnerabilities in public sector cybersecurity.

Maryland launched a Vulnerability Disclosure Program (VDP) to encourage ethical hackers to report security flaws in state systems before malicious actors exploit them. While the initiative itself is proactive, the article highlights systemic risks tied to unpatched vulnerabilities in government infrastructure. Historical context reveals legal ambiguities and hostile responses (e.g., Missouri’s 2021 case where a reporter was accused of 'hacking' for exposing a flaw), deterring responsible disclosure. Maryland’s prior month-long bug bounty uncovered 40+ vulnerabilities, suggesting persistent gaps in cybersecurity resilience. The expansion of the Maryland Information Sharing and Analysis Center (MD-ISAC)—mandating participation from agencies, schools, and critical infrastructure—underscores the urgency to mitigate threats leveraging AI and automation. The program’s 'safe harbor' clause protects good-faith researchers but implies prior exposure to unaddressed vulnerabilities that could have led to breaches, data leaks, or operational disruptions. The lack of a federal mandate for state-level VDPs (unlike CISA’s 2020 directive for federal agencies) leaves Maryland’s systems historically vulnerable to cyber attacks targeting public services, elections, or citizen data. The initiative’s aggressiveness hints at pre-existing high-risk vulnerabilities that, if exploited, could threaten government service continuity, financial systems, or public trust—aligning with impacts seen in attacks on critical infrastructure or regional economies.